All endpoints for this area can only be accessed if the client of the API is authenticated. A client is authenticated via the ADITUS identity provider (IdP) with client credential flow (OAuth2.0).

The client submits a token to the API via the “Authentication” header. The Prefix “Bearer“ must be used for the token value. This token is checked by the IdP via the introspection endpoint and the check result is evaluated by the API.

The prerequisite for successful authentication via the IdP is that the scope Shop is present in the clients token.

Claims

DistributionChainType

Name: client_DistributionChainType

Values:

• Internet

• OnSiteSale

The distribution channel (internet/online or on-site) can be configured using the client's respective claim. However, it is possible for individual clients to take other distribution channels into account by specifying this via the authentication token in the form of the claim “client_DistributionChainType”.

By default, only items from the “Internet” channel are used for the shop API.

Authentication

Authentication could be done by one of two techniques (Basic / OAuth) to access control to a resource. If a request has no "Authorization: [...]" Header set, the request will end in a response of 401: Unauthorized. By sending the Header "Authorization: Basic [...]" or "Authorization: Bearer [...]" the request will be validated with database users credentials.

Basic

Basic Authentication is the simplest technique for enforcing access control to ADITUS api endpoints.

By sending the "Authorization: Basic base64encoded(key:secret)" HTTP Header you request access to the resource.

General structure of the Header looks like the following:

Authorization: Basic dGVzdHVzZXI6dGVzdHBhc3N3b3Jk

The value followed by "Basic " must be encoded in base64. This encoded string is a formatted string containing your key and your secret separated by a single colon (:).

• key:secret

The key and secret can be obtained in WebTERP. You can find a "ADITUS Basic Auth" with key an secret within your profile section "API Logins".

OAuth / OpenID Connect

Authentication can also be done by using handshake techniques. The most used and recommended technique named "OAuth" can also be used for ADITUS api endpoints.

By sending the "Authorization: Bearer token" HTTP Header you request access to the resource.

Authorization: Bearer atrfdzdHVzZXI6dGVzdHBhc3N3b3Jk

To obtain an OAUTH-Token you have to use our OAuth-API-Endpoint.

Authorization

Authorization will currently be done by restrictions on entities. If you are able to change entities in the Frontends, you will also be able to change these entities by calling the API endpoints.